CVE-2026-100229: Gstreamer1-plugins-bad-free: gstreamer1-plugins-bad-free: out-of-bounds write in gst_h266_parser_parse_dci() due to off-by-one array bound check
A flaw was found in GStreamer's H.266 codec parser library (libgstcodecparsers). An out-of-bounds write vulnerability exists in the DCI parsing function, where a reserved field value is incorrectly accepted, causing the parser to write beyond the bounds of an internal structure. An attacker could exploit this by providing a specially crafted H.266 bitstream to a third-party application that uses this library API, potentially causing a crash or memory corruption. No standard GStreamer pipeline element currently invokes the affected code path.
Other sources
GStreamer's H.266 (VVC) codec parser library (libgstcodecparsers) contains an out-of-bounds write vulnerability in gsth266parserparsedci() in gsth266parser.c (line 4812). CHECKALLOWEDMAX(dci->numptlsminus1, 15) allows value 15, but GstH266DCI.profiletierlevel[] has only 15 elements (indices 0..14). When dcinumptlsminus1 is 15, the loop writes past the structure via gsth266parseprofiletierlevel(). H.266 spec defines valid range 0..14; 15 is reserved. Fix: change bound to 14. Introduced in GStreamer 1.26. No in-tree element calls this API. Upstream report awaiting triage, no public patch. Reporter: Bruno Fournier. Tested on 1.29.2 (4cb910d) with ASan. PSIRT: PSIRTSUPT-24646.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Change the bound in gst_h266_parser_parse_dci() from 15 to 14 so reserved value 15 is rejected; GstH266DCI.profile_tier_level[] has valid indices 0..14.
GStreamer's libgstcodecparsers H.266 parser CHECK_ALLOWED_MAX(dci->num_ptls_minus1, ...) = 14
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Applications that directly use GStreamer's H.266 codec parser library API and parse untrusted H.266 bitstreams are exposed. Standard in-tree GStreamer pipeline elements do not currently invoke the affected code path.
What does an attacker need to exploit it?
An attacker needs to provide a specially crafted H.266 bitstream to a third-party application that uses the affected library API. The crafted stream uses the reserved dci_num_ptls_minus1 value of 15, which causes a write beyond the profile_tier_level array.
Are default GStreamer pipelines affected?
No standard GStreamer pipeline element currently calls the affected API, so the vulnerable path is not reached by in-tree pipeline elements. Exposure depends on whether an application or custom component directly invokes the H.266 parser API.
What can be done if a patch is not immediately available?
Avoid parsing untrusted H.266 bitstreams through the affected H.266 parser API. Implementations can reject dci_num_ptls_minus1 values above 14 before invoking the vulnerable parsing path; 15 is reserved and the valid range is 0 through 14.
How can I determine whether my application is affected?
Review whether the application uses libgstcodecparsers and calls gst_h266_parser_parse_dci() or otherwise directly uses the H.266 parser API. The issue was introduced in GStreamer 1.26, and the report states it was tested on 1.29.